Legal Services


Subject Access Request (SAR) Overview

Data protection legislation gives individuals (data subjects) a number of rights including the right to their personal data which an organisation holds on them. Data subjects have a right of access to any personal data held by a data controller (in this case UCL).

What does it cost?

UCL does not charge a fee for subject access requests.

How do I submit a subject access request?

To assist the University in complying with the statutory timescales we will require such requests to made in writing and accompanied by formal identification.

If you wish to submit a request, you should do so by completing the form below:

(November 2018 version 3)


This form will provide the university with the necessary information needed to deal with your request and should be sent by email to data-protection@ucl.ac.uk.

What information can be disclosed?

The right of access extends to all information held on an individual, and includes staff files, student record files, databases, interview notes and e-mails referring to the individual.

Are there any exemptions to the subject access request right provisions?

There are a number of exemptions within the data protection legislation which effectively allow information to be withheld, some of these are summarised below:

What is the time limit for compliance?

The data controller is required to communicate to the data subject the information it holds in an intelligible form within 40 calendar days, starting from the date the request is received by the data controller, or the date on which the prescribed fee, or has been provided with sufficient information by the data subject to locate the information being requested.

Other guidance

Please remember that it is a legal requirement that UCL responds to requests within 40 calendar days, DO NOT delay requests for information.